topic Re: Test if host sends the same logs in Splunk Search

Test if host sends the same logs

bntdumas — Tue, 29 Sep 2020 23:05:44 GMT

Hello,

I have several hosts sending logs to Splunk. These logs depends on the version of the software creating these logs.
I am trying to determine if a query is compatible with host X or Y by looking at the available logs for each host.

Here's a en example.

Host 1 would send:
- Start of initialisation
- Initialisation of device=motor1
- initialisation of device=sensor1
- error during initialisation
- End of initialisation

Host 2 would send:
- Start of initialisation
- Initialisation of device=motor1
- End of initialisation

Here, host2 runs an older version of the software that doesn't logs initialisation of sensor1 and errors.

How could I check if my host publish this or that log line?

Thanks in advance!
Benoit

Re: Test if host sends the same logs

eduardKiyko — Wed, 06 Feb 2019 08:58:46 GMT

Hi, @bntdumas

How can I identify these logs? Is "Start of initialisation" a sourcetype something like that?

Re: Test if host sends the same logs

bntdumas — Wed, 06 Feb 2019 09:51:19 GMT

It could be anything, but mostly keyword based on the text of the logs.

Re: Test if host sends the same logs

vishaltaneja070 — Wed, 06 Feb 2019 10:38:25 GMT

Hello @bntdumas
I think the best way to use it, use of eventtypes.
1. Saved the search with these events as different eventtype like index=* (host=A OR host=B) "Initialisation of device=motor1" as motor1
2. Saved the search with these events as different eventtype like index=* (host=A OR host=B) "initialisation of device=sensor1" as sensor1 like this

and then you can run search like : index=* (host=A or host=B) | chart count by host, eventtype

Re: Test if host sends the same logs

bntdumas — Wed, 06 Feb 2019 12:42:05 GMT

Interesting solution, in this case I would have to define an eventtype for each snippet of log that I'm interested into.
Unfortunately it seems a little heavy, I was searching for a more general solution. Do you think it would be possible?

It would be a bit like a searchmatch, except across all the events.

Re: Test if host sends the same logs

woodcock — Fri, 08 Feb 2019 17:25:41 GMT

Exploit the punct value like this:

| tstats values(punct) AS puncts dc(punct) AS punctCount WHERE (index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo) BY host

The hosts with the most punct values are the ones with the later version.